# Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.11 - Missing Authorization to Unauthenticated Snippet Execution via Code Error Notice

- **ID:** WPSEC-2026-3135
- **Plugin:** Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts (`insert-php`), https://wordpress.org/plugins/insert-php/
- **Affected versions:** from 2.7.0 before 2.7.12
- **Fixed in:** 2.7.12 (Update to 2.7.12 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/insert-php
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3135/

## Description

The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to unauthorized code execution via the 'wbcr_inp_save_snippet_result=code-error' parameter in all versions from 2.7.0 up to, and including, 2.7.11, due to a missing capability check and nonce validation in the get_throw_php_error_notice() function, which runs on admin_init and calls getSnippetError() for a snippet ID taken from the 'post' parameter. This makes it possible for unauthenticated attackers to make the site execute any existing PHP or Universal snippet whenever they choose, including snippets that are deactivated or limited to certain locations or conditions.

## References

- https://wpsec.com/vuln/WPSEC-2026-3135/
- https://plugins.svn.wordpress.org/insert-php/tags/2.7.12/
- https://wordpress.org/plugins/insert-php/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3135/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.